full-disclosure - Vulnerability Disclosure Debate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: Vulnerability Disclosure Debate 

On Thu, 07 Aug 2003 16:35:46 PDT, Darren Bennett said:
> these details. If a company that manufactures locks does a poor job and
> a locksmith publishes how to break into the lock, that should be
> considered a service to all. After all, how can consumers make good
> choices without ALL of the information? Yeah, some will misuse the

Speaking of locksmiths.. ;)

A while ago, Matt Blaze (the same Bellcore guy who did the number on the LEAF
field of the Clipper chipset) published an interesting paper on a better way of
making a master key for a series of locks, given one lock and key.

Turns out:

a) The locksmiths went apeshit, because somebody blabbed a secret that all
the good locksmiths had known for forever.

b) There's other schemes of building series of locks than the one that Matt
broke.

c) The other schemes almost never get deployed in practice because they're more
expensive.

Turns out that Matt's scheme is of mostly theoretical interest, because even
WITH it, to get a master key that fits an "interesting" lock, you still need a
key and lock from the same series, and lots of time to fiddle - and there's
usually some other easier/cheaper/safer way to bypass the interesting lock.

If you *really* want to slow them down, you need something like THIS lockset:

http://www.mas-hamilton.com/x08.html

Of course, these beasts are usually found on GSA Class 5 document containers,
usually called "crypto safes"... ;)

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20030807/8c00eea7/attachment.bin